Function handle_logout 

pub fn handle_logout(ctx: &ReqCtx) -> ApiResponse

Clear the auth cookie and return to the login page. Logout is client-side: it removes the browser’s cookie but cannot invalidate a token already copied elsewhere — that token remains valid until it expires (token_ttl_secs). To force-revoke sessions, rotate jwt_secret (kills all) or wait out a short TTL.